DEBIAN-CVE-2010-2023

transports/appendfile.c in Exim before 4.72, when a world-writable sticky-bit mail directory is used, does not verify the stnlink field of mailbox files, which allows local users to cause a denial of service or possibly gain privileges by creating a hard link to another user's file...

Exim < 4.72 RC2 Multiple Vulnerabilities

Exim is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:exim:exim"; ifdescription...

Mandriva Update for mysql MDVSA-2010:044 (mysql)

Check for the Version of mysql OpenVAS Vulnerability Test Mandriva Update for mysql MDVSA-2010:044 mysql Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...

CentOS 5 : cman (CESA-2009:1341)

Updated cman packages that fix several security issues, various bugs, and add enhancements are now available for Red Hat Enterprise Linux 5. This update has been rated as having low security impact by the Red Hat Security Response Team. The Cluster Manager cman utility provides services for...

CentOS 5 : rgmanager (CESA-2009:1339)

An updated rgmanager package that fixes multiple security issues, various bugs, and adds enhancements is now available for Red Hat Enterprise Linux 5. This update has been rated as having low security impact by the Red Hat Security Response Team. The rgmanager package contains the Red Hat Resourc...

GNU Coreutils不安全临时文件建立漏洞

Bugraq ID: 37256 CVE ID：CVE-2009-4135 GNU Coreutils是一套GNU操作系统所使用的基本文件、shell和文本操控工具。。 GNU Coreutils "distcheck" Makefile规则设置/tmp目录用于之后的任务执行，由于不安全建立临时目录，允许本地攻击者执行符号链接攻击或在部分条件下执行任意代码。 GNU Coreutils 5.2.1 GNU Coreutils 8.1 用户可参考如下供应商提供的补丁程序：...

Debian和Ubuntu Postfix不安全临时文件建立漏洞

Bugraq ID: 36469 CVE ID：CVE-2009-2939 Postfix是一款开放源代码的邮件传输代理，运行在不同类型的UNIX系统上。 Debian和Ubuntu包含的Postfix不安全建立临时文件，本地攻击者可以利用漏洞以应用程序权限覆盖任意文件。 Wietse Venema发现Debian和Ubuntu把/var/spool/postfix/pid的权限设置为postfix:root 0755，这允许postfix用户操作pid文件并通过符号链接攻击覆盖任意文件。 Wietse Venema Postfix 2.5.5 Ubuntu Ubuntu Linux...

cman security update

CentOS Errata and Security Advisory CESA-2009:1341 Updated cman packages that fix several security issues, various bugs, and add enhancements are now available for Red Hat Enterprise Linux 5. This update has been rated as having low security impact by the Red Hat Security Response Team. The Clust...

RedHat Security Advisory RHSA-2009:1339

The remote host is missing updates announced in advisory RHSA-2009:1339. The rgmanager package contains the Red Hat Resource Group Manager, which provides high availability for critical server applications in the event of system downtime. Multiple insecure temporary file use flaws were discovered...

RedHat Security Advisory RHSA-2009:1341

The remote host is missing updates announced in advisory RHSA-2009:1341. The Cluster Manager cman utility provides services for managing a Linux cluster. Multiple insecure temporary file use flaws were found in fenceapcsnmp and ccstool. A local attacker could use these flaws to overwrite an...

RedHat Security Advisory RHSA-2009:1339

The remote host is missing updates announced in advisory RHSA-2009:1339. The rgmanager package contains the Red Hat Resource Group Manager, which provides high availability for critical server applications in the event of system downtime. Multiple insecure temporary file use flaws were discovered...

RedHat Security Advisory RHSA-2009:1337

The remote host is missing updates announced in advisory RHSA-2009:1337. The gfs2-utils package provides the user-space tools necessary to mount, create, maintain, and test GFS2 file systems. Multiple insecure temporary file use flaws were discovered in GFS2 user level utilities. A local attacker...

Low: Red Hat Security Advisory: gfs2-utils security and bug fix update

An updated gfs2-utils package that fixes multiple security issues and various bugs is now available for Red Hat Enterprise Linux 5. This update has been rated as having low security impact by the Red Hat Security Response Team. The gfs2-utils package provides the user-space tools necessary to...

CVE-2009-1786

The malloc subsystem in libc in IBM AIX 5.3 and 6.1 allows local users to create or overwrite arbitrary files via a symlink attack on the log file associated with the MALLOCDEBUG environment variable...

Enomaly ECP多个安全漏洞

BUGTRAQ ID: 33544 CVECAN ID: CVE-2008-4990,CVE-2009-0390 Enomaly ECP（之前名为Enomalism）是用于管理虚拟机的软件。 ECP的enomalism2.sh中存在多个安全漏洞，本地攻击者可以通过符号链接攻击以root用户权限覆盖任意系统文件、向kill命令注入参数以终止任意进程或向进程发送信号，或导致虚拟机无法启动。 Enomaly Elastic Computing Platform 2.1 临时解决方法： 将PIDFILE从/tmp/enomalism2.pid更改为/var/run/enomalism2.pid。...

Gentoo Security Advisory GLSA 200404-08 (automake)

The remote host is missing updates announced in advisory GLSA 200404-08. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

Gentoo Security Advisory GLSA 200404-08 (automake)

The remote host is missing updates announced in advisory GLSA 200404-08. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

FreeBSD Ports: bzip2

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Amarok 'MagnatuneBrowser::listDownloadComplete()'不安全临时文件建立漏洞

BUGTRAQ ID: 30662 CNCAN ID：CNCAN-2008081412 Amarok是一款Linux/Unix平台下的音乐播放器。 Amarok不安全处理临时文件，本地攻击者可以利用漏洞通过符号链接攻击破坏系统文件。 问题存在于'MagnatuneBrowser::listDownloadComplete'函数中，由于不安全建立临时文件，攻击者通过符号链接以用户进程权限覆盖系统的任意文件，造成拒绝服务或特权提升。 Amarok 1.4.9 1 目前没有解决方案提供： http://amarok.kde.org/...

BIND 9.5.0-P2 - Randomized Ports Remote DNS Cache Poisoning

BIND 9.5.0-P2 - Randomized Ports Remote DNS Cache Poisoning Successfully poisoned the latest BIND with fully randomized ports! Exploit required to send more than 130 thousand of requests for the fake records like 131737-4795-15081.blah.com to be able to match port and ID and insert poisoned entry...